@trac3er/oh-my-god 2.1.7 → 2.1.9

package/build/lib/registry/bundles/secure-worktree-pipeline.yaml

@@ -1,6 +1,6 @@
 id: secure-worktree-pipeline
 kind: runtime
-version: 2.1.7
+version: 2.1.9
 title: OMG Secure Worktree Pipeline
 description: Ephemeral worktree execution and supervisor-safe worker dispatch for production jobs.
 hosts:

package/build/lib/registry/bundles/security-check.yaml

@@ -1,6 +1,6 @@
 id: security-check
 kind: security
-version: 2.1.7
+version: 2.1.9
 title: OMG Security Check
 description: Canonical security audit bundle with provenance, trust scoring, and deterministic evidence.
 hosts:

package/build/lib/registry/bundles/test-intent-lock.yaml

@@ -1,6 +1,6 @@
 id: test-intent-lock
 kind: proof
-version: 2.1.7
+version: 2.1.9
 title: OMG Test Intent Lock
 description: Structured test-delta guard that blocks weakened tests unless explicit override evidence is present.
 hosts:

package/build/lib/registry/bundles/tracebank.yaml

@@ -1,6 +1,6 @@
 id: tracebank
 kind: evidence
-version: 2.1.7
+version: 2.1.9
 title: OMG Tracebank
 description: Structured plan-to-patch-to-verify trace capture for OMG routes.
 hosts:

package/build/lib/registry/bundles/vision.yaml

@@ -1,8 +1,8 @@
 id: vision
 kind: domain-pack
-version: 2.1.7
+version: 2.1.9
 title: OMG Vision Pack
-description: Vision-specific lineage, drift, and replay attachments.
+description: Vision-specific OCR, comparison, lineage, drift, and replay attachments.
 hosts:
   - claude
   - codex

package/build/lib/registry/omg-capability.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/trac3er00/OMG/registry/omg-capability.schema.json",
   "title": "OMG Capability Bundle",
-  "version": "2.1.7",
+  "version": "2.1.9",
   "type": "object",
   "required": [
     "id",

package/build/lib/registry/verify_artifact.py

@@ -11,9 +11,6 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
-
 
 @dataclass
 class SupplyArtifact:
@@ -33,6 +30,17 @@ _TRUST_ROOT_PATH = Path(__file__).with_name("trusted_signers.json")
 _DEFAULT_DEV_SIGNER_KEY_ID = "1f5fe64ec2f8c901"
 
 
+def _load_ed25519_backend() -> tuple[Any, Any, Any]:
+    try:
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+    except ModuleNotFoundError as exc:
+        raise ModuleNotFoundError(
+            "cryptography backend unavailable; run OMG setup to provision the managed venv"
+        ) from exc
+    return serialization, Ed25519PrivateKey, Ed25519PublicKey
+
+
 def _utc_now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
@@ -186,6 +194,8 @@ def sign_artifact(
     if len(clean_digest) != 64 or any(ch not in "0123456789abcdef" for ch in clean_digest):
         raise ValueError("subject_digest_must_be_sha256_hex")
 
+    serialization, Ed25519PrivateKey, _ = _load_ed25519_backend()
+
     if signer_private_key:
         private_raw = base64.b64decode(signer_private_key, validate=True)
         if len(private_raw) != 32:
@@ -288,6 +298,11 @@ def sign_artifact_statement(
 
 
 def _verify_ed25519_statement(statement: dict[str, Any]) -> tuple[bool, str]:
+    try:
+        _, _, Ed25519PublicKey = _load_ed25519_backend()
+    except ModuleNotFoundError as exc:
+        return False, str(exc)
+
     key_id = _statement_key_id(statement)
     if not key_id:
         return False, "missing signer key id"

package/build/lib/runtime/__init__.py

@@ -13,6 +13,8 @@ from .compat import (
     list_omg_skills,
 )
 from .ecosystem import ecosystem_status, list_ecosystem_repos, resolve_ecosystem_selection, sync_ecosystem_repos
+from .vision_artifacts import write_vision_artifacts
+from .vision_jobs import run_vision_job
 
 __all__ = [
     "build_compat_gap_report",
@@ -29,4 +31,6 @@ __all__ = [
     "list_ecosystem_repos",
     "resolve_ecosystem_selection",
     "sync_ecosystem_repos",
+    "run_vision_job",
+    "write_vision_artifacts",
 ]

package/build/lib/runtime/adoption.py

@@ -12,7 +12,7 @@ CANONICAL_REPO_URL = "https://github.com/trac3er00/OMG"
 CANONICAL_PACKAGE_NAME = "@trac3er/oh-my-god"
 CANONICAL_PLUGIN_ID = "omg"
 CANONICAL_MARKETPLACE_ID = "omg"
-CANONICAL_VERSION = "2.1.7"
+CANONICAL_VERSION = "2.1.9"
 
 VALID_ADOPTION_MODES = ("omg-only", "coexist")
 CANONICAL_MODE_NAMES = ("chill", "focused", "exploratory")

package/build/lib/runtime/claim_judge.py

@@ -89,6 +89,37 @@ def judge_claims(project_dir: str, claims: list[dict[str, Any]]) -> dict[str, An
     }
 
 
+def evaluate_claims_for_release(
+    project_dir: str,
+    run_id: str,
+    claims: list[dict[str, Any]] | None = None,
+) -> dict[str, Any]:
+    candidate_claims = claims if isinstance(claims, list) and claims else [
+        {
+            "claim_type": "release_ready",
+            "run_id": run_id,
+            "evidence_profile": "release",
+        }
+    ]
+    judged = judge_claims(project_dir, candidate_claims)
+    verdict = str(judged.get("verdict", "")).strip().lower()
+    if verdict in {"fail", "insufficient", "block", "blocked", "error"}:
+        return {
+            "status": "blocked",
+            "authority": "claim_judge",
+            "reason": f"claim_judge_verdict={verdict}",
+            "claim_judge_verdict": verdict,
+            "claim_judge": judged,
+        }
+    return {
+        "status": "allowed",
+        "authority": "claim_judge",
+        "reason": f"claim_judge_verdict={verdict or 'pass'}",
+        "claim_judge_verdict": verdict or "pass",
+        "claim_judge": judged,
+    }
+
+
 def judge_claim(claim: dict[str, Any]) -> dict[str, Any]:
     normalized_claim = _normalize_claim(claim)
     claim_type = str(normalized_claim.get("claim_type", "")).strip()

package/build/lib/runtime/cli_provider.py

@@ -2,19 +2,32 @@
 
 from __future__ import annotations
 
+import os
 import subprocess
 from abc import ABC, abstractmethod
 from typing import Any
+from typing import Mapping
 
 
-def _run_tool(cmd: list[str], *, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+def _run_tool(
+    cmd: list[str],
+    *,
+    timeout: int = 30,
+    cwd: str | None = None,
+    env: Mapping[str, str] | None = None,
+) -> subprocess.CompletedProcess[str]:
     """Run an external tool with a mandatory timeout."""
+    proc_env = os.environ.copy()
+    if env:
+        proc_env.update({key: str(value) for key, value in env.items()})
     return subprocess.run(
         cmd,
         capture_output=True,
         text=True,
         check=False,
         timeout=timeout,
+        cwd=cwd,
+        env=proc_env,
     )
 
 
@@ -53,9 +66,16 @@ class CLIProvider(ABC):
     def write_mcp_config(self, server_url: str, server_name: str = "memory-server") -> None:
         """Write or update MCP server configuration for this provider."""
 
-    def run_tool(self, cmd: list[str], *, timeout: int = 30) -> subprocess.CompletedProcess[str]:
+    def run_tool(
+        self,
+        cmd: list[str],
+        *,
+        timeout: int = 30,
+        cwd: str | None = None,
+        env: Mapping[str, str] | None = None,
+    ) -> subprocess.CompletedProcess[str]:
         """Execute subprocess commands via mandatory timeout helper."""
-        return _run_tool(cmd, timeout=timeout)
+        return _run_tool(cmd, timeout=timeout, cwd=cwd, env=env)
 
 
 _PROVIDER_REGISTRY: dict[str, CLIProvider] = {}

package/build/lib/runtime/compliance_governor.py

@@ -101,7 +101,12 @@ def evaluate_release_compliance(
         }
 
     if not isinstance(release_evidence, dict):
-        return {"status": "blocked", "authority": "artifact", "reason": "no release evidence supplied"}
+        return {
+            "status": "blocked",
+            "authority": "release",
+            "reason": "no release evidence supplied",
+            **artifact_audit,
+        }
 
     raw_claims = release_evidence.get("claims")
     claims = raw_claims if isinstance(raw_claims, list) else []

package/build/lib/runtime/context_engine.py

@@ -17,6 +17,8 @@ from typing import Any
 
 import yaml
 
+from runtime.forge_run_id import build_deterministic_contract
+from runtime.memory_store import MemoryStore
 from runtime.profile_io import profile_version_from_map
 
 _MAX_SUMMARY_CHARS = 1000
@@ -27,6 +29,7 @@ _PROFILE_DIGEST_ARCH_MAX = 3
 _PROFILE_DIGEST_CONSTRAINT_MAX = 5
 _PACKET_REL_PATH = Path(".omg") / "state" / "context_engine_packet.json"
 _PROFILE_REL_PATH = Path(".omg") / "state" / "profile.yaml"
+_MEMORY_STORE_REL_PATH = Path(".omg") / "state" / "memory.sqlite3"
 
 _STATE_PATHS = {
     "architecture_signal": Path(".omg") / "state" / "architecture_signal" / "latest.json",
@@ -271,8 +274,9 @@ class ContextEngine:
     def _build(self, run_id: str, *, delta_only: bool) -> dict[str, Any]:
         raw = self._read_all_state(run_id)
         artifact_pointers = self._collect_artifact_pointers(run_id)
+        artifact_handles = self._collect_artifact_handles(run_id)
 
-        if not artifact_pointers and all(v == {} for v in raw.values()):
+        if not artifact_pointers and not artifact_handles and all(v == {} for v in raw.values()):
             pkt = self._fallback(run_id)
             pkt["delta_only"] = delta_only
             pkt["profile_digest"] = load_profile_digest(self.project_dir)
@@ -297,7 +301,9 @@ class ContextEngine:
         packet: dict[str, Any] = {
             "summary": summary,
             "artifact_pointers": artifact_pointers,
+            "artifact_handles": artifact_handles,
             "clarification_status": self._compose_clarification_status(raw),
+            "governance": self._compose_governance(raw),
             "profile_digest": load_profile_digest(self.project_dir),
             "budget": {
                 "max_chars": _MAX_SUMMARY_CHARS,
@@ -305,6 +311,7 @@ class ContextEngine:
             },
             "delta_only": delta_only,
             "run_id": run_id,
+            "deterministic_contract": build_deterministic_contract(run_id),
         }
 
         self._persist_packet(packet)
@@ -365,6 +372,15 @@ class ContextEngine:
             "confidence": round(confidence, 2),
         }
 
+    def _compose_governance(self, raw: dict[str, Any]) -> dict[str, Any]:
+        intent_gate = raw.get("intent_gate", {})
+        if not isinstance(intent_gate, dict):
+            return {}
+        governance = intent_gate.get("governance")
+        if isinstance(governance, dict):
+            return dict(governance)
+        return {}
+
     def _compose_summary(self, raw: dict[str, Any]) -> str:
         """Compose a bounded summary from state signals."""
         parts: list[str] = []
@@ -438,14 +454,26 @@ class ContextEngine:
         return {
             "summary": "no context signals available",
             "artifact_pointers": [],
+            "artifact_handles": [],
             "clarification_status": {
                 "requires_clarification": False,
                 "intent_class": "",
                 "clarification_prompt": "",
                 "confidence": 0.0,
             },
+            "governance": {},
             "profile_digest": _empty_profile_digest(),
             "budget": {"max_chars": _MAX_SUMMARY_CHARS, "used_chars": 0},
             "delta_only": False,
             "run_id": run_id,
+            "deterministic_contract": build_deterministic_contract(run_id),
         }
+
+    def _collect_artifact_handles(self, run_id: str) -> list[dict[str, Any]]:
+        try:
+            profile_id_raw = str(load_profile_digest(self.project_dir).get("profile_version", "")).strip()
+            profile_id = profile_id_raw if profile_id_raw else None
+            store = MemoryStore(store_path=str(self.project_dir / _MEMORY_STORE_REL_PATH))
+            return store.query_artifacts(run_id=run_id, profile_id=profile_id)
+        except Exception:
+            return []

package/build/lib/runtime/contract_compiler.py

@@ -764,7 +764,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/user-prompt-submit.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/user-prompt-submit.py"',
                         "timeout": 10,
                     }
                 ],
@@ -775,7 +775,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/firewall.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/firewall.py"',
                         "timeout": 10,
                     }
                 ],
@@ -785,7 +785,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/secret-guard.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/secret-guard.py"',
                         "timeout": 10,
                     }
                 ],
@@ -797,7 +797,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/tool-ledger.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/tool-ledger.py"',
                         "timeout": 10,
                     }
                 ],
@@ -809,7 +809,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/post-tool-failure.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/post-tool-failure.py"',
                     }
                 ],
             }
@@ -819,7 +819,7 @@ def _default_claude_hook_registrations() -> dict[str, list[dict[str, Any]]]:
                 "hooks": [
                     {
                         "type": "command",
-                        "command": 'python3 "$HOME/.claude/hooks/instructions-loaded.py"',
+                        "command": '"$HOME/.claude/omg-runtime/.venv/bin/python" "$HOME/.claude/hooks/instructions-loaded.py"',
                         "timeout": 10,
                     }
                 ],
@@ -1142,6 +1142,8 @@ def _render_codex_agents_fragment(
     auto_str = ", ".join(codex_automations) if codex_automations else "contract-compile"
     sections.append(f"- Rules: `{rules_str}`")
     sections.append(f"- Automations: `{auto_str}`")
+    sections.append("- Defer to the repo's `AGENTS.md` / `AGENTS.override.md` instruction hierarchy before OMG-specific guidance.")
+    sections.append("- Do not mirror or override Codex built-in slash commands; OMG guidance applies through MCP, skills, and generated rules.")
     sections.append("- Require explicit invocation for protected production planning skills.")
     sections.append("")
 
@@ -1174,6 +1176,11 @@ def _render_codex_rules(
         lines.append(f"- `{skill}`")
     lines.append("")
 
+    lines.append("## Host Interop\n")
+    lines.append("- Respect the repo `AGENTS.md` / `AGENTS.override.md` chain before applying OMG-specific rules.")
+    lines.append("- Keep OMG guidance separate from Codex built-in slash commands.")
+    lines.append("")
+
     lines.append("## Protected Planning Surface\n")
     if protected_planning_skills:
         for skill in protected_planning_skills:

package/build/lib/runtime/data_lineage.py

@@ -1,9 +1,10 @@
-"""Lineage manifests for generated OMG artifacts."""
 from __future__ import annotations
 
+from collections import deque
 from datetime import datetime, timezone
 import json
 from pathlib import Path
+import sqlite3
 from typing import Any
 from uuid import uuid4
 
@@ -12,6 +13,144 @@ def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
+def _lineage_db_path(project_dir: str) -> Path:
+    return Path(project_dir) / ".omg" / "lineage" / "adjacency.sqlite3"
+
+
+def _lineage_conn(project_dir: str) -> sqlite3.Connection:
+    path = _lineage_db_path(project_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(path)
+    conn.row_factory = sqlite3.Row
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS lineage_edges (
+            edge_id TEXT PRIMARY KEY,
+            parent_node TEXT NOT NULL,
+            child_node TEXT NOT NULL,
+            edge_type TEXT NOT NULL,
+            run_id TEXT NOT NULL,
+            profile_id TEXT NOT NULL,
+            created_at TEXT NOT NULL,
+            metadata_json TEXT NOT NULL DEFAULT '{}'
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_lineage_scope
+        ON lineage_edges(run_id, profile_id, parent_node, child_node)
+        """
+    )
+    conn.commit()
+    return conn
+
+
+def add_lineage_edge(
+    project_dir: str,
+    *,
+    parent_node: str,
+    child_node: str,
+    edge_type: str,
+    run_id: str,
+    profile_id: str,
+    metadata: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    edge_id = f"edge-{uuid4().hex}"
+    payload = {
+        "edge_id": edge_id,
+        "parent_node": parent_node,
+        "child_node": child_node,
+        "edge_type": edge_type,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "created_at": _now(),
+        "metadata": metadata or {},
+    }
+    conn = _lineage_conn(project_dir)
+    conn.execute(
+        """
+        INSERT INTO lineage_edges(
+            edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        """,
+        (
+            payload["edge_id"],
+            payload["parent_node"],
+            payload["child_node"],
+            payload["edge_type"],
+            payload["run_id"],
+            payload["profile_id"],
+            payload["created_at"],
+            json.dumps(payload["metadata"], ensure_ascii=True),
+        ),
+    )
+    conn.commit()
+    conn.close()
+    return payload
+
+
+def traverse_lineage(
+    project_dir: str,
+    *,
+    start_node: str,
+    run_id: str,
+    profile_id: str,
+    max_depth: int = 3,
+) -> dict[str, Any]:
+    bounded_depth = max(1, min(int(max_depth), 16))
+    conn = _lineage_conn(project_dir)
+    queue: deque[tuple[str, int]] = deque([(start_node, 0)])
+    nodes: set[str] = {start_node}
+    seen_edges: set[str] = set()
+    edges: list[dict[str, Any]] = []
+
+    while queue:
+        node, depth = queue.popleft()
+        if depth >= bounded_depth:
+            continue
+        rows = conn.execute(
+            """
+            SELECT edge_id, parent_node, child_node, edge_type, run_id, profile_id, created_at, metadata_json
+            FROM lineage_edges
+            WHERE run_id = ? AND profile_id = ? AND parent_node = ?
+            ORDER BY created_at ASC
+            """,
+            (run_id, profile_id, node),
+        ).fetchall()
+        for row in rows:
+            edge_id = str(row["edge_id"])
+            if edge_id in seen_edges:
+                continue
+            seen_edges.add(edge_id)
+            child_node = str(row["child_node"])
+            nodes.add(child_node)
+            edges.append(
+                {
+                    "edge_id": edge_id,
+                    "parent_node": str(row["parent_node"]),
+                    "child_node": child_node,
+                    "edge_type": str(row["edge_type"]),
+                    "run_id": str(row["run_id"]),
+                    "profile_id": str(row["profile_id"]),
+                    "created_at": str(row["created_at"]),
+                    "metadata": _parse_json_object(row["metadata_json"]),
+                }
+            )
+            queue.append((child_node, depth + 1))
+
+    conn.close()
+    return {
+        "schema": "LineageTraversalResult",
+        "start_node": start_node,
+        "run_id": run_id,
+        "profile_id": profile_id,
+        "max_depth": bounded_depth,
+        "nodes": sorted(nodes),
+        "edges": edges,
+    }
+
+
 def build_lineage_manifest(
     project_dir: str,
     *,
@@ -43,6 +182,18 @@ def build_lineage_manifest(
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(json.dumps(payload, indent=2, ensure_ascii=True) + "\n", encoding="utf-8")
     payload["path"] = rel_path.as_posix()
+
+    trace_node = str(payload.get("trace_id", "")).strip()
+    if trace_node:
+        add_lineage_edge(
+            project_dir,
+            parent_node=trace_node,
+            child_node=lineage_id,
+            edge_type="trace_to_lineage",
+            run_id=trace_node,
+            profile_id="",
+            metadata={"artifact_type": artifact_type},
+        )
     return payload
 
 
@@ -71,3 +222,23 @@ def validate_lineage_manifest(payload: dict[str, Any]) -> dict[str, Any]:
         "status": "ok" if not errors else "error",
         "errors": errors,
     }
+
+
+def _parse_json_object(raw: object) -> dict[str, Any]:
+    if isinstance(raw, dict):
+        return raw
+    if not isinstance(raw, str):
+        return {}
+    try:
+        payload = json.loads(raw)
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return {}
+    return payload if isinstance(payload, dict) else {}
+
+
+__all__ = [
+    "add_lineage_edge",
+    "build_lineage_manifest",
+    "traverse_lineage",
+    "validate_lineage_manifest",
+]

package/build/lib/runtime/domain_packs.py

@@ -16,7 +16,7 @@ DOMAIN_PACKS: dict[str, dict[str, Any]] = {
     "vision": {
         "name": "vision",
         "required_approvals": [],
-        "required_evidence": ["dataset-provenance", "drift-check"],
+        "required_evidence": ["dataset-provenance", "drift-check", "vision-artifacts"],
         "policy_modules": ["dataset-lineage", "drift-gate"],
         "eval_hooks": ["vision-regression"],
         "replay_hooks": ["incident-replay"],